Minecraft Bedrock Dedicated Server: Verified CVE Facts and Reinstallation Steps

CVE-2026-55010 is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server. The NVD record states that an unauthorized attacker can exploit it over a network to execute code. Microsoft, acting as the CVE Numbering Authority, assigned a CVSS 3.1 base score of 9.8. NVD published the record on July 14, 2026.

The NVD record is awaiting enrichment and lists the affected version as -. It does not identify a fixed release, so the record alone cannot establish that a particular server download remediates CVE-2026-55010.

Documented reinstallation steps

1. Enter stop in the server console to shut down the server.
2. Download the Bedrock Dedicated Server package from the official Minecraft server page. Bedrock Dedicated Server supports Windows and Ubuntu Linux.
3. Extract the ZIP package into an empty folder. Microsoft’s documentation also suggests using separate version-specific directories when retaining multiple installations for testing.
4. Start the new installation at least once so it creates its required folders.
5. Copy the existing world folder into the new installation’s worlds/ folder.
6. Set level-name in server.properties to the world folder’s name. The value must match exactly, including letter case.
7. Review the new installation’s configuration. server.properties controls most server options. When allow-list=true, permitted users are stored in allowlist.json.
8. Start or restart the server.

These steps document how to install the available Bedrock Dedicated Server package and reconnect an existing world. They do not verify that the package fixes CVE-2026-55010.